Transcript Week_Fifteen_Net_Designx

Week Fourteen Agenda
Attendance
Announcements
Review Week Fourteen Information
Final Exam Review
Final Exam Composition
True/False questions: 100
Multiple choice questions: 25 (reviewed 7/19)
Drawing questions: 25
Total points: 150
Security Issues
Early networks were not designed for security as all users were
trusted
Modern network security requirements include the following:
Prevent external hackers from getting access to the network
Allow only authorized users into the network
Prevent those inside the network from executing deliberate or
inadvertent attacks
Provide different levels of access for different types of users
Protect data from misuse and corruption
Comply with security legislation, industry standards, and
company policies
Legislation and Security
The U.S. Gramm-Leach-Bliley Act of 1999 (GLBA)
provides limited privacy protections against the sale of private
financial information and codifies protections against
pretexting (concealing)
The U.S. Health Insurance Portability and Accountability Act
(HIPAA)
to enable better access to health insurance, reduce fraud and
abuse, and lower the overall cost of health care in the United
States
European Union data protection Directive 95/46/EC
requires that European Union member states protect people's
privacy rights when processing personal data, and that the flow
of personal data between member states must not be restricted
or prohibited because of these privacy rights
Legislation and Security
The U.S. Sarbanes-Oxley Act of 2002 (SOX)
establishes new or enhanced auditing and financial
standards for all U.S. public company boards,
management, and public accounting firms
Payment Card Industry (PCI) Data Security
Standard (DSS)
developed to ensure safe handling of sensitive
payment information
The Canadian Personal Information Protection and
Electronic Documents Act (PIPEDA):
establishes rules for managing personal information
by organizations involved in commercial activities
Security Terminology
Virus
a program that triggers a damaging outcome
Trojan horse
pretends to be an inoffensive application when in fact
it might contain a destructive payload
SPAM
unsolicited or unwanted email that may contain
viruses or links to compromised web sites
Spyware
a program that gathers information without the user's
knowledge or consent and sends it back to the hacker
Security Terminology (con’t)
Phishing
emails that try to convince the victim to release
personal information
email appears to come from a legitimate source
directs the victim to website that looks legitimate
Spear phishing
very targeted phishing attack
may seem to come from a bank or from within the
company
information may be used to gain access to accounts.
Security Terminology (con’t)
Social engineering
the practice of obtaining confidential information by
manipulating legitimate users. Examples include the
following:
Getting physical access: A hacker might get confidential
information and passwords by having physical access to the
organization. For example, the hacker might visit an
organization and see passwords that are insecurely posted in an
office or cubicle.
Using a psychological approach: A hacker might exploit
human nature to obtain access to confidential information. For
example, a hacker might send an email or call and ask for
passwords, pretending that the information is required to
maintain the victim's account.
Threats
Reconnaissance:
the active gathering of information about an enemy or target
to learn as much as possible about the target and the involved
systems
Usually the prelude to an attack against a particular target.
Gaining unauthorized system access:
the next step after reconnaissance
gaining access to the system by exploiting the system or using
social engineering techniques.
Denial of service (DoS):
does not require direct access to a system
is used to make systems unusable by overloading their
resources such as CPU or bandwidth
multiple sources conduct a DoS attack, it is called a distributed
DoS(DDoS) attack
Targets of Reconnaissance Attacks
• Active targets (hosts/devices currently
communicating on the network)
• Network services that are running
• Operating system platform
• Trust relationships
• File permissions
• User account information
Threat: Gaining Unauthorized Access to Systems
Use of usernames and passwords by unauthorized persons
Threat: DoS
• DoS attacks are aggressive attacks on an
individual computer or groups of computers
with the intent to deny services to intended
users.
• DoS attacks can target end user systems,
servers, routers, and network links
Mitigate DoS Attack
• Use DHCP snooping to verify DHCP transactions and
protect against rogue DHCP servers. DHCP snooping
filters DHCP packets;
• Use Dynamic Address Resolution Protocol (ARP)
Inspection (DAI) to intercept all ARP requests and
replies on untrusted interfaces (ports),
• Implement unicast reverse path forwarding checks to
verify if the source IP address is reachable so that
packets from malformed or forged source IP
addresses are prevented from entering the network.
• Implement access control lists (ACL) to filter traffic.
• Rate-limit traffic such as incoming ARP and DHCP
requests.
Port Scanners
Network Mapper (Nmap): Nmap is a free open-source
utility for network exploration or security auditing. It
was designed to rapidly scan large networks; it also
maps single hosts.
NetStumbler: Net Stumbler is a tool for Microsoft
Windows that facilitates detection of WLANs using
the IEEE 802.11b, 802.11a, and 802.11g WLAN
standards. A trimmed-down version of the tool called
MiniStumbler is available for Windows.
SuperScan: Super Scan is a popular Windows portscanning tool with high scanning speed, host
detection, extensive banner grabbing, and Windows
host enumeration capability.
Port Scanners (con’t)
Kismet: Kismet is an 802.11 Layer 2 wireless
network detector, sniffer, and IDS that can
sniff 802.11b, 802.11a, and 802.11g traffic. It
identifies networks by passively collecting
packets and detecting standard named
networks, detecting hidden networks, and
inferring the presence of non-beaconing
networks (networks that do not advertise
themselves) via data traffic.
Vulnerability Scanners
Nessus: Nessus is an open-source product designed to automate
the testing and discovery of known security problems. A
Windows graphical front end is available, although the core
Nessus product requires Linux or UNIX to run.
Microsoft Baseline Security Analyzer (MBSA): Although it’s
not a true vulnerability scanner, companies that rely primarily
on Microsoft Windows products can use the freely available
MBSA. MBSA scans the system and identifies whether any
patches are missing for products such as the Windows
operating systems, Internet Information Server, SQL Server,
Exchange Server, Internet Explorer, Windows Media Player,
and Microsoft Office products. MBSA also identifies missing
or weak passwords and other common security issues.
Vulnerability Scanners (con’t)
Security Administrator’s Integrated Network
Tool (SAINT): SAINT is a commercial
vulnerability assessment tool that runs
exclusively on UNIX.
Risks
Confidentiality of data:
ensures that only authorized users can view sensitive
information
prevents theft, legal liabilities, and damage to the organization
Integrity of data:
ensures that only authorized users can change sensitive
information
guarantees the authenticity of data
System and data availability:
ensures uninterrupted access to important computing resources
prevents business disruption and loss of productivity.
Risk: Integrity Violations and
Confidentiality Breaches
• Integrity violations can occur when an attacker
attempts to change sensitive data without
proper authorization
• Confidentiality breaches can occur when an
attacker attempts to read sensitive data without
proper authorization
• Confidentiality attacks can be extremely
difficult to detect because the attacker can
copy sensitive data without the owner’s
knowledge and without leaving a trace
Risk: Integrity Violations and
Confidentiality Breaches
Mitigation
• Limit access to network resources using
network access control, such as physical
separation of networks, restrictive firewalls,
and VLANs.
• Limit access to files and objects using
operating system-based access controls, such
as UNIX host security and Windows domain
security.
• Limit user access to data by using applicationlevel controls, such as different user profiles
for different roles.
Mitigation (con’t)
• Use cryptography to protect data outside the
application. Examples include encryption to
provide confidentiality, and secure fingerprints
or digital signatures to provide data
authenticity and integrity.
Considerations
Business needs: What the organization wants to do
with the network
Risk analysis: The risk-versus-cost balance
Security policy: The policies, standards, and
guidelines that address business needs and risk
Industry-recommended practices: The reliable,
well-understood, and recommended security practices
in the industry
Security operations: The process for incident
response, monitoring, maintenance, and compliance
auditing of the system
What is a Network Security Policy?
• A Network Security Policy is a broad, end-toend document designed to be clearly
applicable to an organization's operations.
• The policy is used to aid in network design,
convey security principles, and facilitate
network deployments
• Is a complex document meant to govern items
such as data access, web browsing, password
usage, encryption, and email attachments
What is in the Network Security Policy?
• The network security policy outlines rules for
network access, determines how policies are
enforced, and describes the basic architecture
of the organization's network security
environment
• The network security policy outlines what
assets need to be protected and gives guidance
on how it should be protected
• Because of its breadth of coverage and impact,
it is usually compiled by a committee
Formulating A Network Security Policy
Risk Assessment and Management
As part of developing a security policy, you should
perform a risk assessment and cost-benefit analysis,
including considering the latest attack techniques
• Risk assessment defines threats, their probability, and
their severity
• Network security employs risk management to reduce
risk to acceptable levels.
• It is important to note that risks are not eliminated by
network security; they are reduced to levels
acceptable to the organization
• The cost of security should not exceed the cost of
potential security incidents
Know the Risks
• What assets to secure
• The monetary value of the assets
• The actual loss that would result from an
attack
• The severity and the probability that an
attack against the assets will occur
• How to use security policy to control or
minimize the risks
Risk Index
The probability of risk (in other words, the likelihood that compromise
will occur)
The severity of loss in the event of compromise of an asset
The ability to control or manage the risk
The Concept of Trust
• Trust is the relationship between two or more
network entities that are permitted to
communicate
• Security policy decisions are largely based on
this premise of trust.
• If you are trusted, you are allowed to
communicate as needed.
• However, at times security controls need to
apply restraint to trust relationships by limiting
access to the designated privilege level.
Domains of Trust
Domains of Trust are a way to group network systems that share a
common policy or function.
Network segments have different trust levels, depending on the
resources they are securing. When applying security controls within
network segments
Trust in Operation on a Cisco ASA
Appliance
Identity
• The identity is the whoof of a trust
relationship.
• The identity of a network entity is
verified by credentials:
Passwords, tokens, and certificates
Authentication (Proof of Identity)
Based on one (or more) of the following:
• Something the subject knows: This usually
involves knowledge of a unique secret, which
the authenticating parties usually share. To a
user, this secret appears as a classic password,
a personal identification number, or a private
cryptographic key.
• Something the subject has: This usually
involves physical possession of an item that is
unique to the subject. Examples include
password token cards, Smartcards, and
hardware keys.
Authentication (Proof of Identity)
• Something the subject is: This involves
verifying a subject’s unique physical
characteristic, such as a fingerprint, retina
pattern, voice, or face.
Access Control
• Access control is the ability to enforce a policy
that states which entities (such as users,
servers, and applications) can access which
network resources.
Access Control Through AAA
Which entities (such as users, servers, and applications) can
access which network resources.
• Authentication
establish the subject's identity
• Authorization
define what a subject can do in a network limit access to a
network
• Accounting
audit trail provides evidence and accounting of the
subject's actions
real-time monitoring provides security services such as
intrusion detection.
Trust and Identity Management
Technologies
• ACLs: Lists maintained by network devices such as
routers, switches, and firewalls to control access
through the device. An example is an ACL on a router
that specifies which clients, based on their IP
addresses, can connect to a critical server in the data
center.
• Firewall: A device designed to permit or deny
network traffic based on certain characteristics, such
as source address, destination address, protocol, port
number, and application. The firewall enforces the
access and authorization policy in the network by
specifying which connections are permitted or denied
between security perimeters.
Trust and Identity Management
Technologies (con’t)
• NAC: A set of technologies and solutions that uses the network
infrastructure to enforce security policy compliance on all
devices trying to access network computing resources, thereby
limiting damage from emerging security threats.
• IEEE 802.1X: An IEEE standard for media-level access
control, providing the ability to permit or deny network
connectivity, control VLAN access, and apply traffic policy
based on user or device identity.
• Cisco Identity-Based Networking Services (IBNS): An
integrated solution combining several Cisco products that offer
authentication, access control, and user policies to secure
network connectivity and resources.
ACL (Access Control List)
Firewall
A device designed to permit or deny network traffic based on certain
characteristics
The firewall enforces the access and authorization policy in the
network by specifying which connections are permitted or denied
between security perimeters
Cisco NAC
• Network Admission Control
http://www.cisco.com/assets/cdc_content_eleme
nts/flash/nac/demo.htm
Confidentiality Through Encryption
Cryptography provides confidentiality through encryption,
which is the process of disguising a message to hide its
original content
Encryption Keys
• For encryption and decryption to work, devices need
keys.
The sender needs a key to lock (encrypt) the message,
and the receiver needs a key to unlock (decrypt) the
message.
• Two types of keys:
shared secrets (symmetric)
The keys to encode and decode the message are
the same
Asymmetric keys -the Public Key Infrastructure
(PKI)
The keys to encode and decode are different, but
related; they come as a pair (the public/private keys)
Integrity Through Secure Fingerprints and
Digital Signatures
• Integrity means that the data have not
been altered
• Proof the data have not changed is
provided through a combination of
encryption and a hash function
• Digital signatures use PKI (Asymmetric
keys)
• Secure Fingerprints use a shared secret
key
Integrity Through Secure Fingerprints and
Digital Signatures (con’t)
HMAC is an algorithm used for secure fingerprints
What is a hash?
• A hash is the result of a one-way mathematical
function
• A hash is a fixed length string produced by a
hashing function:
Both the message and hash are sent
The message recipient uses the same hash
function on the message
Their hash result should be the same as
the hash that was sent; otherwise, the
message has changed
What is a hash?
VPNs
• IPsec VPNs use the IKE protocol to exchange
keys; IKE normally uses PKI certificates.
IPsec requires both communicating endpoints
to run software that understands IPsec. Most
routers and security appliances currently
support high-speed IPsec
• SSL VPNs are built on top of the TCP layer
using port 443, the HTTPS port. SSL VPNs are
used extensively to provide confidentiality for
web traffic and are supported by all major
browsers
Intrusion Detection System
Intrusion Detection System
Network Security Solutions
• Cisco IOS Routers
Cisco IOS Firewall
Cisco IOS IPS
IPSec
VPN Modules
• VPN Concentrators
• ASA/PIX
• IPS
Implementing Security Throughout the
Enterprise
Enterprise Campus
Enterprise Edge and WAN Security
Upcoming Deadlines
• Final exam administered by the Student
Learning Center (SLC) on August 1 – 6.